Security readout for executives and security teams
Plain-English summary
A nearby attacker may send an abnormally short Bluetooth report to a Linux system using the Wacom Intuos driver. The driver can read beyond the report’s valid data, potentially exposing sensitive kernel information or disrupting the system. The supplied record rates the issue 8.1 (high), but provides no evidence of active exploitation.
Executive priority
Treat this as a high-priority endpoint patching issue where Wacom Bluetooth functionality is present. The adjacent-access requirement limits internet-scale exposure, but possible kernel confidentiality loss and system disruption justify prompt remediation. Use normal emergency prioritization for directly exposed or sensitive workstations; broader fleets should follow accelerated kernel maintenance.
Technical view
wacom_intuos_bt_irq() insufficiently validates Bluetooth HID report lengths before copying data into the Wacom structure. Report 0x03 requires at least 22 bytes; report 0x04 requires 32 bytes and falls through to 0x03 processing. Crafted short reports can cause an out-of-bounds read, with confidentiality and availability impacts indicated by the CVSS vector.
Likely exposure
Exposure is most likely on Linux hosts where an affected kernel processes Wacom Intuos Bluetooth HID reports. The supplied version information is ambiguous, including repeated commit hashes and a broad version list, so kernel version strings alone are insufficient. Confirm distribution-specific backports and whether the relevant hardware and driver path are used.
Exploitation context
The CVSS vector requires adjacent access, consistent with the Bluetooth attack surface, but requires no privileges or user interaction. The bundle marks the CVE as absent from KEV and provides no cited evidence of exploitation, proof-of-concept availability, or weaponization. Active exploitation should therefore not be claimed.
Researcher notes
The correction adds explicit minimum-length checks and warning logs for short report IDs 0x03 and 0x04. The bundle supplies multiple stable-kernel commits but no CWE, crash trace, affected configuration matrix, proof of concept, or exploitation evidence. Validate each distribution’s backport lineage rather than assuming upstream version boundaries apply directly.
Mitigation direction
- Install a distribution kernel incorporating the applicable referenced stable fix.
- Confirm backport status through the Linux distribution or kernel vendor.
- Prioritize endpoints that use Wacom Intuos devices over Bluetooth.
- Restrict Wacom Bluetooth use on exposed systems until updates are applied.
- Monitor vendor guidance for corrected package versions and additional mitigations.
Validation and detection
- Inventory Linux kernels and systems using Wacom Intuos Bluetooth devices.
- Determine whether the Wacom HID Bluetooth processing path is enabled or loaded.
- Compare installed packages with distributor backport or fixed-kernel guidance.
- After updating and rebooting, verify the corrected kernel is running.
- Review kernel logs for short-report warnings, without treating them as proof of exploitation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43051 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H2.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aadaCVE reference, Linux
- https://git.kernel.org/stable/c/5b5b9730111808410e404ceac2fabd32eef92fbdCVE reference, Linux
- https://git.kernel.org/stable/c/fa8901cb1f0b2113a342db93bd5684b59fe99dcfCVE reference, Linux
- https://git.kernel.org/stable/c/8bd690ac1242332c73cba10dacdad6c6642bbb94CVE reference, Linux
- https://git.kernel.org/stable/c/41026bcc0fdf82605205c27935ef719cbc07193bCVE reference, Linux
- https://git.kernel.org/stable/c/c8dc23c97680eebefde06da5858aaef1b37cf75dCVE reference, Linux
- https://git.kernel.org/stable/c/3d78386b144453c47e81bf62dc3601b757f02d99CVE reference, Linux
- https://git.kernel.org/stable/c/2f1763f62909ccb6386ac50350fa0abbf5bb16a9CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.